Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a Windows Server 2003 / XP LAN, non admin domain users are able to manage the users and groups of the local computer including changing the Administrator password and make themselves Administrators of the local computer.

How is this possible and how can I prevent it?

share|improve this question
Your users aren't local administration are they? – Dan Jan 19 '12 at 8:56
No. They aren't even local users. There is just Admin and Guest account for locals. – rism Jan 19 '12 at 9:29
That doesn't mean they're not local administrators - check the "Administrators" group on the machine. – Dan Jan 19 '12 at 9:31
O.k. now we are cooking. You are right the staff domain group has been assigned to Administrators group on the local machine. If you could tell me how to drop that using GPO in Answer then I will accept. Thanks. – rism Jan 19 '12 at 9:51
Rism, they're not assigned that role by default. It's not a case of knowing how to alter that setting, you should find where it's set and un-set it. If its already set in a GPO somewhere and you create another GPO to un-set it then you'll just have inconsistent results. – RobM Jan 19 '12 at 10:05
up vote 3 down vote accepted

Confirm that the staff aren't local administrators by checking the local Administrators group on the machine.

You should be able to remove these by creating a GPO which manipulates the local Administrators security group. This can be done using the "Restricted Groups" section in your GPO:

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted Groups

(NB: Be aware that this will effectively overwrite the Local Admin group so ensure you include anyone that's required to be a local administrator)

Or, if you've set up Group Policy Preferences, you could use that too for more flexibility.

share|improve this answer
Also, what Rob says, though I presumed that this had been done manually to be honest! – Dan Jan 19 '12 at 10:06
Thanks a lot. There's only a handful of clients so you may be right re: manual addition. I guess I can test this by removing from client and then logging in again? If the setting comes back it must have been set in GPO right? – rism Jan 19 '12 at 10:13
Reboot rather than log in, but yeah, that's a fairly sound theory. Or do a GPResult and go through. – Dan Jan 19 '12 at 10:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.